In which of the following scenarios is an event type more effective than a saved search?

Question

Options

• AWhen a search should always include the same time range.
• BWhen a search needs to be added to other users' dashboards.
• CWhen the search string needs to be used in future searches.
• DWhen formatting needs to be included with the search string.

• A
  10% (4)
• B
  3% (1)
• C
  83% (33)
• D
  5% (2)

Explanation

Event types are more effective than saved searches when you need to reuse a search string within other searches, because an event type can be referenced inline using 'eventtype=<name>' inside any search query. This makes them composable and embeddable. Saved searches are better suited for scheduled reports, alerts, and dashboard panels. Option A is wrong because event types do not support time range constraints - saved searches do. Option B is better served by saved searches or reports. Option D describes event type color-coding, but formatting alone is not the primary advantage over saved searches.

No community discussion yet for this question.